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Abstract — The linear aerospike engine is being developed 
for single-stage-to-orbit (SSTO) applications. The primary 
advantages of a linear aerospike engine over a conventional 
bell nozzle engine include altitude compensation, which 
provides enhanced performance, and lower vehicle weight 
resulting from the integration of the engine into the vehicle 
structure. A feature of this integration is the ability to 
provide thrust vector control (TVC) by differential 
throttling of the engine combustion elements, rather than 
the more conventional approach of gimballing the entire 
engine. An analysis of the X-33 flight trajectories has 
shown that it is necessary to provide ± 15% roll, pitch and 
yaw TVC authority with an optional capability of ±30% 
pitch at select times during the mission. The TVC 
performance requirements for the X-33 engine became a 
major driver in the design of the engine control system. 

The thrust level of the X-33 engine as well as the amount of 
TVC are managed by a control system which consists of 
electronics, instrumentation, propellant valves, electro- 
mechanical actuators, spark igniters, and harnesses. The 
engine control system is responsible for thrust control, 
mixture ratio control, thrust vector control, engine health 
monitoring, and communication to the vehicle during all 
operational modes of the engine (checkout, pre-start, start, 
main-stage, shutdown and post shutdown). 

The methodology for thrust vector control, the health 
monitoring approach which includes failure detection, 
isolation, and response, and the basic control system design 
are the topics of this paper. As an additional point of 
interest a brief description of the X-33 engine system will 
be included in this paper. 
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1 . Introduction 

The X-33 is an advanced technology vehicle to demonstrate 
the configuration and technologies of a single stage to orbit 
(SSTO) reusable launch vehicle (RLV) concept 
incorporating a lifting body design using a linear aerospike 
engine for propulsion. The X-33 is a single stage, reusable 
vehicle designed for vertical takeoff, sub-orbital flight and 
horizontal landing. The RLV program goal is to create a 
reusable launch vehicle with reduced operational costs and 
quick turnaround times. The X-33 is a 53% geometrically 
scaled replica of the RLV aero-ballistic body configuration. 
The vehicle configuration is a delta-shaped lifting body 
with aerodynamic control surfaces. The X-33 will provide 
functional traceability and scaleability to the RLV. 
Subsystems of the X-33 are designed to replicate the 
functions of the RLV and demonstrate key performance 
enhancing technologies. The X-33 vehicle is depicted in 
Figure 1. 



Figure 1. X-33 Vehicle 


The main propulsion for vertical launch and ascent is 
provided by two XRS-2200 linear aerospike engines using 
liquid oxygen and liquid hydrogen propellants. The XRS- 
2200 engine is a pump fed, gas generator cycle engine with 
a truncated ideal linear aerospike nozzle, shown in Figure 
2. Each engine can deliver 200,000+ lbs of thrust at sea 
level. 

The primary advantages of the linear aerospike engine over 
a conventional bell nozzle engine include altitude 
compensation, which provides enhanced performance, and 
lower vehicle weight resulting from the integration of the 
engine into the vehicle structure. This engine / vehicle 
integrated structure approach will save weight and 
concurrently provide more uniform distribution of engine 
loads into the vehicle structure. A feature of thts 
integration is the ability to provide thrust vector control 
(TVC) by differential throttling of the engine, rather than 
the more conventional approach of gimballing the engine. 



Figure 2. XRS-2200 Engine 

A key feature of the X-33 engine is differential throttling 
for thrust vector control (TVC) used to provide the main 
source of vehicle attitude control during the powered 
portion of the flight. An analysis of the X-33 flight 
trajectories has shown that it is necessary to provide ± 15% 
TVC control with an optional capability of ± 30% pitch at 
select times during the mission. The engine requires 1.3 
seconds to reconfigure the control elements to support the 
30% pitch capability. This reconfiguration comes with a 
performance loss which results in the need for making the 
pitch level optional. The TVC requirements for the X-33 
engine became a major driver in the design of the engine 
control system. 

To accomplish the TVC as well as control and monitor the 
engine’s performance an electronic control system was 


implemented. The architecture chosen was driven by the 
engine control performance requirements as well as the 
reliability requirements. To meet the fail-operational 
requirements of the X-33 vehicle, the engine control system 
provides redundancy for all critical electrical components. 
The performance requirements had a significant impact on 
the response capabilities of the system. These requirements 
also played a major role in the design of the propellant 
valves, the electronics, and the methodology of redundancy 
management. The engine control system operates in 
conjunction with the vehicle guidance and control system to 
accomplish overall vehicle control. The engine control 
system is responsible to provide the following functions: 

Engine to Vehicle communication 
Closed loop control of engine thrust and 
propellant mixture ratio 
Closed loop thrust vector control 
Real-time engine Health Monitoring 
28VDC power distribution 
270VDC power control to engine valve actuators 
Control of engine purges 
Control of engine event sequencing 
Perform all checkouts and self-tests 
Engine redundancy management 


2. X33 Engine Description 

The X-33 main engine is the XRS-2200 linear aerospike 
rocket engine which provides propulsive thrust by burning 
a combination of liquid hydrogen and liquid oxygen. The 
engine employs a gas generator cycle with a single gas 
generator providing fuel-rich drive gas for the fuel and 
oxidizer turbopump turbines in a series power drive 
arrangement. Main combustion gases are generated in a 
linear row of individual thrusters arranged in two banks. 
The high pressure combustion gases are expanded against 
the aerospike nozzle ramp surface to provide propulsive 
thrust for the flight vehicle. The engine design incorporates 
existing components from the Apollo/Saturn J-2 and J-2S 
engines. Two XRS-2200 engines power the X-33 and are 
arranged side-to-side along the base of the vehicle for 
efficient packaging and integration with the vehicle 
airframe. 

The most unique feature of the XRS-2200 engine is the 
linear aerospike nozzle which is a truncated radial in-flow 
or spike type nozzle. The X-33 engine is mounted to the 
vehicle such that the nozzle ramps are roughly centered 
about the pitch axis of the vehicle. Two banks of ten thrust 
cells each are arrayed on each side of the nozzle along the 
vehicle-to-engine interface. The primary flow (high 
pressure gases) is exhausted from the thrust cells and 
expanded against the nozzle ramp surfaces to provide the 
altitude compensated portion of the engine thrust. The 


outer surface of the gas flow along each side of the nozzle 
ramp is a free-jet boundary which expands as the ambient 
pressure decreases thereby providing altitude compensated 
thrust performance for sea-level to vacuum operation. 
Beyond the ends of the nozzle ramp surfaces, the inner 
surface of the primary flow expands to enclose a 
recirculating flow field which acts on the nozzle base to 
contribute additional thrust to the nozzle. A secondary 
flow (turbine drive gases) is exhausted through the nozzle 
base and adds to the recirculating flow to increase the base 
pressure and the overall nozzle efficiency. 

The two XRS-2200 engines installed on the X-33 vehicle 
are designed to be cross-coupled through fuel and oxidizer 
inter-engine isolation valves to provide a powerpack-out 
capability. This arrangement allows the powerpack of one 
engine to feed the thrusters of both engines in the event that 
one powerpack becomes inoperable. This feature provides 
the capability to maintain symmetrical thrust about the 
vehicle centerline. 


Thrust Chamber Assembly (TCA) 

The thrust chamber assembly for each engine refers to the 
combination of the two sets of ten thrust cells and one 
nozzle ramp each which combined provide the major 
portion of the engine thrust (a small additional amount of 
thrust is produced by the GG exhaust through the engine 
base closeout). Each thrust cell contains an injector which 
injects the fuel and oxidizer propellants into the thrust cells 
where combustion occurs to produce hot gas under high 
pressure which is expelled out the thrust cell, producing 70 
to 80 percent of the total engine delivered thrust. The 
resulting hot gases are expanded against the nozzle ramp 
surfaces to produce the remainder of the thrust. The thrust 
is transmitted to the vehicle through the combustors and 
expansion ramps to the thrust mounts which attach to the 
vehicle thrust structure. 
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Figure 3. X-33 Engine (Top view) 


3. Engine Control System 
Design 


Control System Partitioning 


The control system provides for 
engine control, checkout, and health 
monitoring of the XRS-2200 engine 
system. The XRS-2200 engine 
control and monitoring system 
components operate together to meet 
the control system requirements. It 
functions in conjunction with the 
vehicle management computers 
(VMC’s) located on the vehicle, as 
shown in figure 4, and consists 


Powerpack Assembly (PPA) 

The XRS-2200 engine uses a gas generator (GG) power 
cycle to drive fuel and oxidizer turbopumps, which furnish 
the thrust cells and GG with pressurized propellants. The 
GG creates a fuel rich, hot gas which drives a two-stage 
turbine on the fuel turbopump followed by a similar two- 
stage turbine on the oxidizer turbopump. After passing 
through the oxidizer turbine, the hot gas passes across a 
helium system heat exchanger (HEX) and then is exhausted 
through the engine base closeout. The combination of the 
GG, two turbopumps, HEX, and interconnecting hot gas 
ducting is referred to as the powerpack 


of the following: 

• Two engine control data interface units (ECDIU’s) 

• Three remote health nodes (RHN’s) and 

associated sensor 

• Eleven main propellant valves 

• Six fully throttleable electrically actuated 
valves 

• Five pneumatically actuated valves 

• Gas Generator (GG) and combustion wave 
ignition systems 

• Pneumatic spin start for engine turbopumps 

• Engine pneumatic system 

• Instrumentation (pressure, temperature, speed and 
position sensors) 




Figure 4. Engine/Vehicle electronics layout 


A top-level schematic diagram of the engine control system 
is shown in Figure 5. Engine control is accomplished by 
the ECDIU’ s which receive and execute engine commands 
from the VMC’s, while transmitting engine performance 
data to the vehicle for recording/transmission by the vehicle 
health monitoring (VHM) system. The vehicle commands 
establish the set points for engine power level and TVC 
control. The ECDIU controls all of the critical operations 
on the engine. It provides commands to all effectors (valve 
actuators, solenoids, igniters etc.). All instrumentation 
necessary for engine control/health monitoring interfaces 
with the ECDIU, which provides all necessary excitation 
and signal conditioning. Engine control, checkout and self- 
test procedures are controlled by the software resident 
within the ECDIU. 


The ECDIU monitors the engines for real-time health 
status, while the RHN’s monitor the engines for long term 
health. The RHNs are custom devices that have the 
capability to interface to 24 low-frequency instruments 
(resistive temperature devices [RTDs], thermocouples, or 
strain-gauge based pressure sensors) and 8 high-frequency 
instruments (strain- gauges, accelerometers, etc.). There are 
three RHNs on each engine to provide for data interfacing 
of flight test instrumentation (FTI) and engine performance 
instruments. The data from the RHNs is transmitted to the 
vehicle health monitoring (VHM) computer for recording. 

The control system incorporates two sets of 
instrumentation: ECDIU instrumentation for real-time 
performance evaluation and closed loop control, and RHN 
instrumentation for post-flight engine performance and 
health evaluation. The ECDIU instrumentation is made up 
of RTD’s, thermocouples, low-frequency pressure sensors, 
and inductive reluctance speed sensors. The RHN sensors 
include the above sensor types as well as accelerometers, 
strain gages and high-frequency pressure sensors. 

The primary engine control valves are shown in the 
schematic in Figure 5 and consist of pneumatically actuated 
fuel and oxidizer powerpack isolation, inter-engine 
isolation and combustion wave ignition pilot valves 
(PPFIV, PPOIV, IEFIV, IEOIV, CWFV and CWOV) and 
electro-mechanically actuated (EMA) gas generator (GG) 
and thrust vector control (TVC) valves (GGFV, GGOV, 
OTVCV and FTVCV). Pneumatically actuated valves are 
controlled either on or off, and electrically actuated valves 
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Figure 5. Top-level Control System diagram 








are modulated to controlled positions by open or closed 
loop control depending on the engine command being 
executed. Each EMA is controlled by a separate electronic 
component. The electro-mechanical actuator electronic 
controller (EMAEC) maintains the local loop for the 
EMAs. The ECDIU provides position commands to the 
EMAECs, which then control the EMAs to that position. 
The EMAEC was separated from the low-voltage ECDIU 
due to corona concerns. The EMA’s operate with 270 
VDC which is provided by the vehicle via the EMAECs. 

Component requirements 

The basic requirements for the XRS-2200 engine control 
system components are described in the following sections. 

Engine Control Data Interface Units — The pair of 
ECDIU’s operates in conjunction with the VMC’s and the 
engine sensors, valves, actuators, and spark igniters to 
provide a system for the control, checkout, and health 
monitoring of the engine system. The ECDIU’s provide the 
following engine system functions: 

• receive electrical power from the vehicle 

• provide power switching, conversion, regulation, and 
distribution for engine electrical components (except 
for the electro-mechanical actuators) 

• receive engine commands from the VMC’s 

• transmit ECDIU engine data to the vehicle 

• exchange data with the other ECDIU 

• provide excitation signals, signal conditioning, and 
multiplexing for sensor interfaces 

• provide closed loop control of valve actuator positions 

• provide on/off commands to solenoid valves and spark 
igniters 

• provide control system built-in test (BIT) capability 

• provide real time health monitoring (sensor validation, 
redlines, yellowlines) 

• perform redundancy management for control 
components. 

Remote Health Nodes — The three RHN’s are a standard 
design used throughout the vehicle which handle 44 
channels of data as described in the following: 

• 8 high bandwidth (up to 5 KHz) 

• 24 low bandwidth (up to 200 Hz) 

• 3 auxiliary (frequency counter, resolver, 
analog input) 

• 8 discrete inputs 

The RHN’s interface with the VHM sensors and provide 
the data to the VHM system over a fiber-optic bus for 
engine system health monitoring data and post-flight 


assessment of the engine condition and performance. This 
data is recorded on the vehicle while a select subset of the 
data is telemetered for real-time ground-based analysis (see 
figure 4). 

Electro-mechanical Actuator Electronic Controllers — The 
EMAECs provide position control of the six electrically 
actuated valves by receiving input commands from the 
ECDIU’s, transmitting position commands to the valve 
actuators, and receiving feedback position data from the 
valves. The EMAEC’ s also provide power to actuator 
heaters and control the actuator brakes. The brakes are 
designed to mechanically provide friction to the shaft while 
also removing power from the pulse width modulators 
(PWMs). Additionally, prior to removing the power from 
the PWM, the EMAECs freeze the PWM output to increase 
the braking power. This results in both mechanically and 
electrically locking the valve position. 

RLV traceability 

One key requirement for the X-33 vehicle is to provide 
traceability to the RLV phase of the program. This 
requirement is being met in several ways for the control 
system design. The ECDIUs which use primarily 
commercial-off-the-shelf (COTS) equipment proves the 
viability of COTS equipment in space systems, while the 
RHNs use a fiber-optic bus for communication. The EMAs 
with EMAECs have great potential in that they enable 
elimination of hydraulics from the vehicle. Additionally, 
the software resident in the ECDIUs will use autocoded 
software with a commercial real-time operating system. 
Some of these technologies are being used on a closed-loop 
rocket engine for the first time and will provide significant 
cost/weight benefits to the RLV program. 

Redundancy Management 

The X-33 has a requirement that “In the event of any single 
electrical component failure, all engine systems shall 
remain operational ” This requirement drove the design 
into a dual redundant system for all critical electrical 
components. Extensive analysis of all systems including 
the ECDIU software has been performed to verify that this 
requirement was met. The process of system 
reconfiguration will be verified in a hardware-in-the-Ioop 
(HWIL) test facility at NASA-Marshall Space Flight Center 
(MSFC). 


Environmental Concerns 

One of the most challenging aspects of the control system 
design is meeting the environmental requirements for each 


of the electronic components. The environment of a rocket 
engine during launch can be very difficult for modern 
electronics to survive. The thermal requirements of the 
ECDIU required special mounting provisions along with 
limitations being placed on the ECDIU software to level the 
power dissipation. 

The vibration levels seen on the XRS-2200 may exceed 1.5 
g 2 /Hz in the 100-300 Hz range. This drove the electronics 
design in two different directions. The ECDIUs and RHNs 
added vibration isolators while the EMAECs use primarily 
surface mount technology with board/component adhesive 
to survive the vibration. 

The explosion proof requirement for any electrical 
component within an environment that sees hydrogen gas 
required environmental sealing, similar to that required for 
humidity protection. The basic goal is to prevent 
‘breathing’ during atmospheric pressure changes, thereby 
preventing the ingestion of hydrogen gas into the electronic 
component. 


4. Engine Control 

Control of the engine during mainstage is performed by the 
ECDIU’s which receive commands from the vehicle and 
issue commands to the electrically actuated GG and TVC 
valves. Mainstage engine control consists of thrust control, 


MR control, thrust vector control, and GG temperature 
control. A top level control logic schematic is shown in 
figure 6. This schematic shows the flow of commands from 
the vehicle through the ECDIUs to the engine propellant 
valves. 

Gas Generator Temperature Control 

GG temperature control is accomplished via open loop 
control of the GGFV to specified positions based on the 
average thrust cell pressure and engine MR commands. 

Thrust Control 

Thrust control is accomplished via closed loop control of 
the GGOV. The ECDIU’s convert Pc (chamber pressure) 
and MR (mixture ratio) commands to desired GG Pc. 
Actual GG Pc is measured and provided as feedback 
information to the ECDIU’s which issue commands to the 
GGOV to achieve the desired GG Pc and engine thrust. 
The GGOV sets the power available to the thruster banks. 
The engine can be throttled within a range from 57 % to 
100% power level (P.L.) with a steady state error (Ess) <; 
1% P.L. and a maximum throttling rate is 30%P.L./sec. 
During throttling, the engine MR must stay within the 
boundaries defined in the operational envelope shown in 
figure 7. The engine mode determines the P.L. and MR 
region of operation available for commands. 
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Figure 6. X-33 Control law diagrams 
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For large amplitude excursions (Delta P.L > 0.75%), the 
maximum tracking error between commanded power level 
and actual power level during a transient will be as shown 
in figure 8. 


Maximum % Power Level Tracking Error 



Below 0.75% P.L. the tracking error is defined in gain and 
phase frequency response plots not shown. 


Mixture Ratio (MR) Control 


MR control is accomplished via closed loop control of the 
two FTVCV’s. Fuel injector pressures and temperatures 
and thruster bank chamber pressure level are provided as 
feedback information to the ECDIU’s which calculate 
required thruster bank fuel flow and issues commands to 
the two FTVCV’s to achieve the desired MR in each 
thruster bank. LOX flow is determined based on the 
measured chamber pressure and calculated fuel flow, and 
GG flows are calculated based on the GG pressure. The 
engine can be operated at any MR within the bounds of 
engine mode region of operation shown in figure 7, with an 
actual Ess < 4% of nominal MR. 


7VC Control 


The X-33 vehicle flight control is accomplished by a 
combination of aero surface deflection and engine thrust 
vectoring. Engine TVC commands from the vehicle are 
implemented by closed loop control of the two OTVCV’s. 
Thruster bank chamber pressure levels are measured and 
provided as feedback information to the ECDIU’s which 



issue commands to the two OTVCV’s to achieve the 
desired thrust chamber pressure levels in each thruster 
bank. The TVC differential throttling capability controls 
the propellant flowrates to the upper and lower thruster 
banks on each engine to provide pitch, roll, and yaw control 
as shown in Figure 9. The maximum rate that TVC 
commands can be executed is 60% P.L./sec. The engine 
system is capable of performing roll and pitch TVC while 
maintaining the total engine thrust constant. Pitch and roll 
TVC are performed by adjusting the differential throttling 
valves on both of the installed engines, and yaw TVC is 
performed by differentiating the GG power levels to each 
engine. There are two normal operational modes for TVC; 
nominal 15% pitch and 30% pitch. When operating in the 
nominal 15% mode, the engine can be commanded up to 
15% roll, pitch or yaw. When the engine is operating in the 
30% pitch mode, the engine can be commanded up to 30% 
pitch, 15% roll and 7.7% yaw. Due to the higher operating 
pressures required in the GG for 30% operation, there is a 
minor engine response penalty, and a reduction in GG yaw 
capability. The pitch option is controlled by a discrete 
input from the VMC to the ECDIU which switches between 
the two control laws. During powerpack out (PPO) when 
only one powerpack is operating, yaw TVC is performed by 
the differential throttling valves. The cross valves are open 
allowing propellant to flow to or from engine to engine. 
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Figure 9. TVC diagrams. 


Operational Constraints 


There are certain engine operational restrictions that must 
be followed for engine hardware protection. In the normal 
TVC mode of operation, the value of any bank’s P.L. must 
be within 15% of the average bank’s P.L. In addition, each 
engine must operate within the defined P.L. vs MR 
operating envelope, see Figure 7. Similar constraints apply 
for each mode of operation, with additional restrictions 
during transition between regions of operation. 

In addition, at certain combinations of P.L., MR and 
altitude, the engine experiences a roll control reversal. 
These combinations must be avoided during flight 
operation. 


5. Health Monitoring 

The XRS-2200 health monitoring system (HMS) evaluates 
the engine system performance and responds accordingly to 
safely obtain the mission objectives. An integrated systems 
analysis was conducted to define the requirements for the 
health monitoring system for detecting unsafe performance, 
isolating the problem, and responding appropriately. The 
systems analysis combined the engine instrumentation, 
event sequencing, control law implementation, turnaround 
operations, and development testing into an integrated 
health monitoring system. The health monitoring system 
architecture encompasses automated pre-launch sequencing 
checkouts, pre-engine start health monitoring, holddown 
algorithm, flight safety monitoring, automated post test 
diagnostics, and ground test safety. The health monitoring 
approach description follows. 
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Figure 10. HMS timeline vs. Main chamber pressure 




performance analysis. In addition, an integrated event 
sequencing timeline analysis established the operations and 
time period when monitoring is required. This approach 
produced a system that safely meets the operational, safety 
and performance objectives of the program. Figure 10 
depicts the modes of HMS and when they are active. 

Automated pre-launch sequencing checkouts 

Automated pre-launch sequencing checkouts verify the 
engine control systems are functional prior to initiating 
launch sequence operations. Actuator calibration routine 
(ACAL), actuator checkout module (ACM), pneumatic 
checkout, electrical system checkouts, ECDIU checkouts, 
and flight readiness tests (FRT) provide the necessary 
system verification. ACAL automatically calibrates the 
actuator position feedback sensors. The signal at the open 
and closed stops are processed to give the correct position 
feedback for accurate control. The ACM verifies both 
channels of the valve actuator are functioning properly. 
Actuator performance characteristics such as rate, position, 
command, brake, and switchover performance are verified. 
The pneumatic system checkout verifies the purge 
solenoids, pneumatic valve actuation solenoids, and engine 
system solenoids are functional. The algorithm uses purge 
pressure, position and current feedback to accomplish the 
checkout. Electrical checkouts are performed to verify all 
electrical systems are properly connected and the proper 
signal path integrity is not compromised. The electrical 
systems include the ignition system, instrumentation, and 
the ECDIUs. The final checkout is the FRT. This test 
simulates the actual countdown and mission from beginning 
to end. The engine commands, control laws, and software 
are exercised. Feedback parameters are simulated based on 
engine valve positions. This test is the overall engine 
control system check. At this point the engine control 
system is ready to transition to the launch purge sequence 
operations (PSN) to prepare for engine start. 

Pre-start health monitoring 

Prestart health monitoring verifies proper engine propellant 
conditioning and launch configuration setup. The 
monitoring during this period includes leak detection, 
engine conditioning, engine ready, sensor qualification, and 
actuator monitoring. Greenline monitoring is the 
monitoring performed during the pre-start phase to verify 
the engine is operational. An example of this is leak 
detection, which verifies the engine internal leakage is not 
above the safe limit by measuring the temperature of the 
ducts downstream of the valves. The selected 
instrumentation detects valve and pump seal leakages. 
Engine conditioning verifies the engine is in the proper 
configuration during the prestart period. This includes 
valve positions, bleed system functions, and purge activity. 


Improper engine conditioning is unacceptable for engine 
performance and will delay countdown until proper 
conditioning can be verified. In addition, sensor 
qualification monitoring is active during this period to 
verify decisions are based on valid data and to verify any 
data from parameters that will be used in subsequent 
periods is valid before proceeding with the launch 
countdown. Actuator monitoring is also accomplished to 
verify proper valve position and feedback. This is critical 
to engine control. Engine ready monitoring verifies the 
conditions are acceptable for engine start. The monitoring 
includes pump inlet conditions and pneumatic system 
conditions. When the engine has successfully transitioned 
into engine ready a signal is sent to the VMC that the start 
enable (STEN)/ start (STRT) command sequence may be 
issued. 


Holddown Algorithm 

The holddown algorithm, Launch Assessment Window 
(LAW), evaluates the engine system operation during start 
up and prior to liftoff. The monitoring consists of ignition 
detection, thrust build up, actuator monitoring, sensor 
qualification, and launch assessment window. Ignition 
detection confirms the main combustion system and the gas 
generation systems have properly ignited and combustion is 
active. Without proper ignition, the system can not safely 
continue operation. The thrust build up check monitors 
engine performance and system sequences as the system 
bootstraps up to mainstage. This monitoring will be based 
on test experience from the development program. A 
database will be established and implemented into the 
health monitoring system. Sensor qualification and actuator 
monitoring are active during this time period. The LAW is 
a check of the engine system, including the engine 
hardware, software, and control laws, at 80 percent 
powerlevel from 5.5 to 6.0 seconds. Successful completion 
of the LAW provides the vehicle with the engine 
authorization to command liftoff. In the event of a LAW 
failure, the engine will autonomously command engine 
shutdown. The threshold monitors during this period will 
be based on a statistical approach using multiple engine 
parameters. 


Flight Safety Algorithm 

The flight safety algorithm monitors the engine system from 
LAW completion to landing or ECDIU power termination. 
Control parameter monitoring, powerpack out monitoring, 
and yellowline monitoring encompass the flight safety. The 
control parameters (valve position, pressure, temperature) 
are monitored to determine valid feedback signal which is 
required to control the engine thrust and mixture ratio. For 
loss of control parameter, a yellowline condition will be 



invoked to continue the mission at a reduced performance 
or redundancy. Actuator performance is also evaluated to 
maintain proper valve position. The engine control system 
has the capability of switching over to the redundant 
actuator channel if loss of control occurs on the first 
channel. If the engine system reaches a point where unsafe 
operation of one of the powerpacks occurs (redline), a 
powerpack out command may be initiated shutting down a 
single powerpack and operating both engines with one 
powerpack at a reduced engine thrust. Yellowline monitors 
will also be utilized to prevent/delay implementation of the 
powerpack out operating mode. Options include powering 
down both engines or limiting the valve positions, which 
could reduce power and/or TVC capability. Development 
of this logic is integrated with the flight trajectory due to 
the impacts on vehicle control. The yellowlines will be 
developed and validated during the ground test program. 

Turnaround Maintenance 

Turnaround maintenance and next flight clearance utilize 
data analysis techniques to determine the state of engine 
hardware and assist in the turnaround process by 
eliminating inspections and isolating damaged hardware. 
The goal of post flight data analysis is to reduce operations 
and maintenance costs where turnaround time is a major 
cost driver. The integrated health monitoring focuses on 
the process of monitoring the engine for the purpose of 
assessing engine health. This is performed through 
intrusive and non-intrusive sensors that feed into and are 
compared to a historical database for performance / life 
trends assessment. To accomplish this task, a post flight 
database and expert system will be developed/re fined 
during the ground test program. The system will be 
capable of storing and manipulating performance and HMS 
data from all tests, engine component design data, and 
component manufacturing data. The system will 
automatically analyze data to assist in determining the 
condition of the engines for next test./ flight. Next flight 
readiness prediction will be assessed through statistical 
analysis, historical data and ground test data. The system is 
called the Post Test Diagnostic System (PTDS). The 
database and expert system will be developed utilizing the 
engine model and actual hotfire test results. Sensor 
selection and placement included addressing issues such as 
health monitoring and involved experts from each technical 
discipline to determine the best sensor suite for providing 
data which would allow for the optimal assessment of 
engine health. 


Ground Test Safety 

The ground test safety system provides for a conservative 
test program that protects the hardware. Due to the high 


cost of engine hardware, the ground test program’s HMS 
objective is to protect the engine. As compared to the 
vehicle’s HMS objective, which is to extend mission 
duration even at the cost of the engine. This system utilizes 
multiple systems to assure ground test safety objectives 
which include: ECDIU monitoring, facility monitored 
engine parameters, facility monitors, observer monitors, 
and system of safety (SOS) development. The ECDIU 
monitoring for ground test safety will not be the same as 
performed for flight monitoring. The ground test program 
will determine what monitors are the most effective and 
have the best potential benefit for the flight program. 
Facility monitors include the Radial Accelerometer Safety 
Cutoff System (RASCOS), Real Time Vibration 
Monitoring System (RTVMS), and the High Speed 
Observer. These systems give the engine additional 
protection and monitor one of the best indicators of engine / 
pump health; the vibration signature. Facility and observer 
monitors protect both the facility and the engines and 
encompass many failure scenarios. History indicates these 
systems catch what other systems do not detect. An 
example of this is seen in plume spectrometry analysis, 
which analyzes the content of the engine exhaust. 
Significant amounts of certain elements may indicate a 
potential catastrophic failure is imminent. Finally, a system 
of safety (SOS) algorithm will be developed in monitor 
mode only for future use. The system compares the actual 
engine performance to a real time model output. The logic 
developed utilizes the interrelationship of the engine 
parameters to determine engine health. Conceptually, it is a 
system approach to health monitoring because it does not 
rely on one parameter to make a decision. The 
development program will prove the feasibility of the SOS 
monitor for use on the RLV program. 


6. Conclusion 

The unique integration of the linear aerospike engine into 
the vehicle structure allows for a reduction of the length of 
the launch vehicle, thereby creating significant weight 
savings. The differential throttling concept permits steering 
of the vehicle without the imposition of heavy and 
expensive hydraulic actuator systems, as well as the 
additional complexity of designing the engines for 
gimballing. This “built in” capability does complicate the 
engine control system, but does not significantly impact 
hardware complexity, as most of the TVC components exist 
to perform the basic engine operating functions. 

A detailed assessment was performed to attain a control 
system that met the system requirements while maintaining 
reasonable cost controls. 

The control system design incorporates redundant 
electronic controllers, redundant instrumentation 



redundant EMAs with separate EMA controllers, valves 
and solenoids to provide for engine control and health 
monitoring. A fail-safe approach was used for all single 
string components, while redundancy was used when this 
was not possible. An example of this is that all single string 
solenoid failures place the associated valve in its nominal 
position during flight. 

To provide for traceability, the technical advancements of 
the X-33 control system seek to prove the validity of COTS 
components and fiber-optics for use on the RLV. 

The extensive use of health monitoring will significantly 
reduce the operational costs while increasing the safety of 
the future reusable launch vehicle. 
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